411 reputation
36
bio website matthias.vallentin.net
location Berkeley, CA
age
visits member for 2 years, 8 months
seen Sep 26 at 3:48

I am PhD student at UC Berkeley where I develop distributed systems for large-scale intrusion detection, network forensics, and incident response.


Sep
24
awarded  Autobiographer
Mar
22
awarded  Yearling
Jun
13
awarded  Nice Answer
Mar
22
awarded  Yearling
Feb
20
answered non-periodic event detection
Jan
31
answered How to tell if you're being ARP poisoned?
Nov
11
comment Anomaly Intrusion Detection relevant features
The security community highly discourages the use of the DARPA data set (and the derived KDD CUP) for any meaningful research. I recommend reading John McHugh's critique and Robin Sommer's paper on this topic.
Aug
21
awarded  Caucus
Aug
21
awarded  Constituent
Jul
7
answered Can voice chat be spied?
May
23
comment Published data sets for IDS/IPS evaluation
Unfortunately I am not aware of any reasonable public data sets precisely because they are so difficult to create in the first place. For a NIDS, you could start with traffic traces of known attacks, but be aware that this is quite an isolated setting closer to unit testing. At a broader scope, it's highly valuable to evaluate IDSs in multiple environments and understanding why does it perform as it does, as complex detection algorithms may not always give an obvious answer to this question.
May
23
comment Published data sets for IDS/IPS evaluation
The IDS research community strongly discourages the use of the DARPA (and the derived KDD Cup) data set for any meaningful research. In general, it is non-trivial to generate such data sets: icir.org/vern/cs261n/papers/TISSEC-mchugh-critique.pdf.
Apr
2
comment Stateful Signatures in an IPS
Hopefully the added notes on scalability clarify this a bit. I do not use stateless signatures. Almost all important security incidents I come across are stateful. Also, signatures are essentially regular languages which are strictly inferior to the Turing-complete scripting language offered by NIDS like Bro.
Apr
2
awarded  Editor
Apr
2
revised Stateful Signatures in an IPS
Add notes on scalability.
Mar
31
answered Stateful Signatures in an IPS
Mar
30
answered monitoring outgoing network traffic
Mar
29
comment Stateful Signatures in an IPS
By asymmetric traffic, do you mean asymmetric routing in a multi-homed network?
Mar
29
comment SSL with GET and POST
To add a detail, the browser makes the destination host visible through the Server Name Indication (SNI) extension of TLS.
Mar
23
awarded  Supporter